Skip to content

feat: add public key and doc #225

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
maxday wants to merge 1 commit into
base: master
Choose a base branch
from
+50 −0
Open

feat: add public key and doc #225

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,37 @@ Then invoke it from another terminal:
$ curl -XPOST "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"answer":42}'
```

## Verifying Release Artifacts

The prebuilt static libraries attached to each [GitHub release](https://github.com/awslabs/aws-lambda-cpp/releases) are signed with GPG so you can verify their authenticity and integrity before use.

The public half of the signing key is published in this repository as [`signing-public-key.asc`](signing-public-key.asc). Its fingerprint is:

```
4A25 1DDC 40B2 8DF1 5295 07B9 B24A 651A CB13 2CBA
```

### Steps

1. Import the public key and confirm the fingerprint matches the value above:
```bash
$ gpg --import signing-public-key.asc
$ gpg --fingerprint B24A651ACB132CBA
```

2. Download the artifacts you want along with `SHA256SUMS` and `SHA256SUMS.asc` from the release page.

3. Verify the checksums file was signed by the key, then check the artifacts against it:
```bash
$ gpg --verify SHA256SUMS.asc SHA256SUMS
$ sha256sum --check --ignore-missing SHA256SUMS
```

Alternatively, verify an individual library directly against its detached signature:
```bash
$ gpg --verify libaws-lambda-runtime-x86_64.a.asc libaws-lambda-runtime-x86_64.a
```

## Using the C++ SDK for AWS with this runtime
This library is completely independent from the AWS C++ SDK. You should treat the AWS C++ SDK as just another dependency in your application.
See [the examples section](https://github.com/awslabs/aws-lambda-cpp/tree/master/examples/) for a demo utilizing the AWS C++ SDK with this Lambda runtime.
Expand Down
19 changes: 19 additions & 0 deletions signing-public-key.asc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.22 (GNU/Linux)

mQENBGp+Xm0BCAD8XJJrskJ+H7Q0Ox8i9wXzjlgadU10RJY/Ahc2lnp+03i2hbvt
FQKGFSkIVd6/1ELl7KXx16pjoSD1WlyyzJuWTcgvJCPfqXySF88aEKsRLHHgipCr
J1p8OQpjxfyiVOtmq5WyELBx84LiPRqTMmp0cMLuKbJW3GxRbW1XT2rYpFIIEp/9
xiQ0JAHbpqClrX4i39dJ21dNKVAzENmjYBv/t5u46laNjL++SRP+eE6gUOAvcpN9
295WzzeBbzWj5yyHyOpQaflfNkVAatUwotyHfbe6bNJRRSrWSkBBU3oiFV/1S46q
KSwAZHid5EK1tBwyT0O1axylPNs8BACMMBitABEBAAG0PWF3c2xhbWJkYSAoYXdz
IGxhbWJkYSBjcHAgc2lnbmluZyBrZXkpIDxzb21ldGhpbmdAYW1hem9uLmNvbT6J
AT8EEwECACkFAmp+Xm0CGwMFCQHhM4AHCwkIBwMCAQYVCAIJCgsEFgIDAQIeAQIX
gAAKCRCySmUayxMsuoVRB/0YfTbpLkp3iITaqEtvyAX5FtG4YVPcHp+i1JuFZ2vA
yeDmGA1CizQ1j2D8v89z0l4zOxr2bEhbePNJMXBeRYUQKbZHjerOtcW8v76eD3ca
DQzSsPRK7yqcJvUet8FmHQPzi6RHihX4YJoVvK9HUUqsHY3uqiww9Eomzbo8ulHH
eesgFeUs8ZMrL0HNwiX1NAwRuARrDsv/rVH+LOKAn57EjmmNWrAjY/yJyhOwnZzs
oAbKFV7xxmg9mgUUqR/tD/6pYkN9i4lcdX1PtWjB1Is9Eav8NYSEVm9vXffN2NO0
jrjvRe3tbRL1mSkooy9791sDOr7LyxbIUd5GkEP0MEJh
=ci3t
-----END PGP PUBLIC KEY BLOCK-----
Loading